LDAP + Windows AD + ad4unix

作者: cross 日期: 2006-11-14 15:13

字體大小: 小中大

Linux using LDAP with Active Directory

OS:

windows 2003 server(AD)
fedora core1(openldap)

方法

於windows 2003 AD 上Installing MKS AD4Unix
於fedora core1 上 installing OpenLDAP 、NSS_LDAP and PAM_LDAP

Fedora linux端

[1. ] vi /etc/ldap.conf

Host 192.168.1.167

BASE dc=123,dc=com

Ldap_version 3

Binddn cn=administrator,cn=Users,dc=123,dc=com

Bindpw 123456

Port 389

Scope sub

nss_base_passwd cn=Users,dc=123,dc=com?sub

nss_base_shadow cn=Users, dc=123,dc=com?sub

nss_base_group cn=Group,dc=123,dc=com?sub

nss_map_objectclass posixAccount User

nss_map_objectclass shadowAccount User

nss_map_attribute uid sAMAccountName

# nss_map_attribute userPassword msSFUPassword

nss_map_attribute homeDirectory msSFUHomeDirectory

nss_map_objectclass posixGroup Group

nss_map_attribute uniqueMember member

nss_map_attribute cn sAMAccountName

pam_login_attribute sAMAccountName

pam_filter objectclass=user

pam_password ad

[2. ] authconfig

test

ldapsearch -x -D "cn=administrator,cn=Users,dc=123,dc=com" –W "sAMAccountName=del"

[3. ] vi /etc/nsswitch.conf

Passwd: files ldap

Group: files ldap

Shadow: files ldap

[4.] vi /etc/pam.d/login

#%PAM-1.0

auth       required       /lib/security/pam_securetty.so

auth       required       /lib/security/pam_nologin.so

auth       sufficient     /lib/security/pam_ldap.so

auth       required       /lib/security/pam_warn.so

auth       required       /lib/security/pam_unix_auth.so try_first_pass

account    sufficient   /lib/security/pam_ldap.so

account    required     /lib/security/pam_warn.so

account    required     /lib/security/pam_unix_acct.so

password   required    /lib/security/pam_ldap.so

session    required      /lib/security/pam_unix_session.so

session    required      /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0022

session    optional      /lib/security/pam_console.so

[5.] vi /etc/pam.d/sshd

auth    required        /lib/security/pam_env.so

auth    sufficient      /lib/security/pam_ldap.so

auth    sufficient      /lib/security/pam_unix.so use_first_pass likeauth

auth    required        /lib/security/pam_deny.so